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PROGRAMS 



Field Of The Invention 



The present invention relates generally to computer programs for providing anti- virus 
protection for computers from computer viruses, and more specifically to optimization of the 
10 performance of such anti- virus computer programs. 



Background Of The Invention 
The design and implementation of anti- virus computer programs for protecting 
computers from damage and/or interruption of operation due to computer viruses are well 
known in the art. A great deal of time and effort is spent in the design of such anti- virus 
1 5 programs to reduce the amount of computer time required by such programs for detecting 
viruses in computer files, and preventing detected virus contaminated or infected files from 
being written onto the hard drive or other storage media associated with a particular computer 
system or server. The use of computer networks for interconnecting a plurality of computers, 
either on a local or wide area network, has provided increasingly greater opportunity for so- 
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5 called "computer hackers" to introduce viruses into the associated computers. The now 
widespread use of the Internet, and World Wide Web, has caused a major increase in the 
introduction of computer viruses into computer systems connected to such networks. In turn, 
anti-virus programs have to be continuously updated and expanded in order to recognize, 
cope with, and cleanse infected computer files of myriad viruses that may be introduced by 
10 hackers. As the number of computer viruses scanned for by anti-virus programs increases, 
the time required for scanning a given file for any such viruses increases in proportion to the 
increase in the number of viruses. Accordingly, computer programmers associated with the 
design of anti-virus computer programs are continuously searching for methods to reduce the 
computer time these programs must spend in scanning files for viruses. 

15 In U.S. 5,649,095, entitled "Method and Apparatus For Detecting Computer Viruses 

Through The Use Of A Scan Information Cache", the length information of one portion of a 
file, e.g. a fork, is upon opening stored in a cache. Upon initiating a scan of the file, the 
length of the portion of the file corresponding to the portion in cache is compared to the 
length of the latter. If a size difference is detected, the file is only scanned for viruses which 

20 cause a change in the length or size of that portion of a file, thereby eliminating spending time 
scanning for other viruses. The teachings of U.S. 5,649,095 are incorporated herein by 
reference to the extent they do not conflict herewith. 

In U.S. Serial No. 09/481,060, filed January 11, 2000, owned by the same Assignee 
as the present invention, and entitled "Fast Virus Scanning Using Scanning Stamping," a 
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5 unique session key is created for each execution of anti-virus software, and is used to create a 
session stamp for each file scanned during the associated execution. The session stamps are 
stored for use by the anti-virus software to validate a session stamp when a request for an 
associated file is made. A file is scanned if the session stamp is invalid or absent for that file. 

Summary Of The Invention 

j0 An object of the present invention is to provide a method for minimizing the scanning 

of an opened file for viruses between the time a user requests closure of the file, and the time 
that the file is actually closed, typically upon writing back to a hard disk or to a floppy disk. 

In one embodiment of the invention, the aforesaid object and other objects of the 
invention are met by including computer code in the anti-virus program to respond to a 

1 5 request for closure of a file by a user of a particular computer or computer system, by first 
determining whether a flag has been set or raised by the operating system indicating that the 
file was modified between the time it was open to the time when the user requested closure of 
the file. Certain operating systems provide such modification flags through the use of a "dirty 
cache buffer." If such a flag is set or raised indicating that the file was modified during this 

20 time, the computer coding causes the anti-virus program to scan the file for known viruses, 
and if a file is found to be infected by a virus, the anti-virus program prevents the file from 
being written back into the hard disk, or other storage media of the system, until such time 
that the file is cleansed of the virus. However, if no flag was detected indicating that the file 
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was modified during the time that it was opened, then the file is considered to be unmodified 
and free of viruses. The operating system is then released by the antivirus program to write 
the file into the desired storage media, such as a hard disk. Accordingly, the present 
invention avoids wasting valuable computer time in scanning open files, or checking file 
information caches, for viruses before they are closed, by taking advantage of operating 
systems that are designed to raise or set a flag whenever a file that has been opened is 
modified during the time that it has been opened. 

In a second embodiment of the invention, if upon a user request to close an open file a 
modification flag is detected for the file, the next step is to determine whether the file was 
modified in a portion of the file that viruses can enter. If such a modification was made, the 
file is scanned. If such a modification was not made, the operating system is released to close 
the file. 

Brief Description Of The Drawings 

Various embodiments of the present invention will be described in detail below with 
reference to the drawings, in which like items are identified by the same reference 
designation, wherein: 

Figure 1 shows a typical local area computer network of the prior art, in this example 
Ethernet, for connecting a network server network operating system with a plurality of 
personal computer operating systems, such as desktop systems, laptop computers, and so 



KW:mmw/090600/l 1221 005. APP 
5 forth; 



Figure 2 is a flowchart showing the traditional scanning method of the prior art for the 
typical steps associated with scanning an open file for viruses; 

Figure 3 shows a flowchart for one embodiment of the invention for minimizing the 
unnecessary scanning of an open file for viruses before the file is closed; and 

1 o Figure 4 shows another embodiment of the invention for minimizing the necessity of 

scanning an open file for viruses before it is closed in the presence of a file information cache 
or any other optimization cache. 

Detailed Description Of The Invention 

As shown in Figure 1, a typical local area network known as an Ethernet 2 is used to 
1 5 permit a network server computer 4 loaded with an appropriate network operating system 6 to 
communicate with a plurality of personal computers such as desk top personal computers 8, 
and typical laptop personal computers 10, include a hard disk drive 16 for storing a PC 
operating system 12, and other programs and data. Disk buffers 14 provide an interface 
between the hard disk drive 16 and the central processing unit (not shown) of the personal 
20 computer 8, for permitting the operating system 12 to provide computer code for running the 
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5 central processing unit, and other subsystems of the personal computer 8. A similar 

configuration is used in laptop 10. In the server computer 4, a memory device 18 is provided 
for storing files, and for storing an operating system for driving the central processing unit 
(not shown) of the server 4, in applications where another memory device is not available for 
storing the network operating system 6. Cache buffers 20 provide an interface for the 

1 0 temporary storage of files retrieved from the file storage memory 1 8 for distribution from the 
server to 1 of the personal computers 8 or laptop computers 10, in this example, connected to 
the Ethernet 2. 

In the present state of the art, computer systems that are properly configured for 
providing protection against computer viruses, typically permit the opening and closing of 

1 5 files using the steps shown in the flowchart of Figure 2. A user of a personal computer 8 or 
laptop computer 10, as shown in Figure 1, can request the server computer 4 to open a file for 
write access, as indicated by step 22. Please note that although various embodiments of the 
present invention are described in association with a computer network, such as the Ethernet 
2 of Figure 1, the invention is not so limited, and can be implemented through use of any 

20 other known network. Also, various embodiments of the present invention are applicable for 
use by a user directly on their own dedicated personal computer 8 or laptop 10. For these and 
other computer figurations, it is typical after a file is opened for write access in step 22, to 
next scan the file for viruses in step 24, via a computer anti-virus program. If no viruses are 
detected in step 24, step 26 is entered for providing the requested file to the Application 

25 program of the user. A period of time after the file is opened, it is typical that a user will 
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5 request that the file be closed. Upon a file closure request being made in step 28, the typical 
anti-virus program loaded into a computer system, such as network server computer 4, 
interfaces with the network operating system 6 to scan the file for viruses in step 30 before 
permitting the file to be written back into memory. As shown in decision step 32, if a file is 
found to be infected with a virus, the anti-virus program proceeds to step 34 for preventing 

10 the infected file from being written into memory, such as file storage memory 1 8. 

Alternatively, if in step 32 no virus is uncovered, the anti- virus program proceeds to step 36 
for allowing the operating system to write the file back into memory. The last step 38, 
indicative that scanning has been completed, terminates the typical virus protection program 
scanning routine. Note that in some state-of-art operating systems, the cache buffers 20 are 

1 5 used to store files upon opening in an unmodified state. Before step 36, the file to be closed 
is compared to the corresponding unmodified file in a cache buffer memory 30. If the file to 
be closed is found to be identical to the unmodified cached file, write step 36 is skipped, and 
the open file is closed with only the file's time stamp being updated. In computers not loaded 
with an anti-virus program, the file comparison occurs after step 28. 

20 With reference to Figure 3, a first embodiment of the invention provides additional 

steps for an anti-virus program operating in conjunction with an operating system. Note that 
steps 22, 24, 26, 28, 30, 32, 34, 36, and 38 are the same as the traditional scanning steps for 
an anti-virus program of Figure 2. In this first embodiment of the invention, new steps 40 
and 42 are included. As shown, step 40 is a decision step interposed between steps 28 and 

25 30. Decision step 40 determines whether a file was actually written, that is modified by the 
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user performing some writing step on the open file. The computer coding for step 40 
determines whether an open file was actually written or modified by looking for a flag in the 
operating system indicative of such modification. Many state-of-art operating systems 
provide such flags, which are used by the operating system to avoid rewriting a file back into 
memory if it has not been modified. If the anti- virus program in step 40 does find that a 
modification flag has been set or raised by the operating system, then step 30 is entered into 
for scanning the file for viruses. If on the other hand no modification flag is found, the file is 
considered clean, and the operating system is allowed to write the file back into the memory 
in step 42, as shown, or simply close the file. If an operating system does not provide such 
modification flags, the first embodiment of the invention can be extended to add cache buffer 
memories 20, and appropriate computer coding to incorporate the modification flag function 
into the operating system. 

Note that one operating system that provides modification flags is the Novell NetWare 
4.X® and later versions, which has a function call FEGetOpenFileInfo(). One of the 
parameters of this function is a file handle that indicates a file has been opened. The 
aforesaid function call also includes a parameter known as "flags" field for providing flags to 
indicate the status of the file. Typically, such flags are not well documented by Novell®, but 
the inventor has determined through inquiry that such flags can be used to obtain what is 
known as a "dirty cache buffer" state of the file. Such a flag provides an indication of 
whether a file was modified. The associated operating system uses such flags for optimizing 
closure of open files, by avoiding the time for rewriting to disk if the file was not modified as 
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5 indicated by the lack of the modification flag being set or raised. As previously indicated, the 
first embodiment of the present invention uses the absence of such modification flags after a 
call for closure of a file to avoid scanning the file for viruses, and uses the presence of such a 
modification flag to scan the file for viruses before permitting writing of the file back into 
memory. 

10 A second embodiment is shown in the flowchart of Figure 4. In comparing this 

second embodiment of the invention with the first embodiment shown in Figure 3, note that 
the second embodiment includes a new step 44 between both steps 24 and 26, and another 
new step 46 between both steps 40 and 42, and steps 40 and 30, as shown in Figure 4. More 
specifically, step 44 uses a full cache buffer memory 20 for storing an entire file. Typically 

1 5 there are specific portions of a file that a virus must use by necessity in order to invade the 

file. In operation of the programming steps of the second embodiment of the invention, if in 
step 40 a flag indicative of modification of the file is not detected, the present computer 
program proceeds through steps 42 and 38, as in the first embodiment of the invention of 
Figure 3. If however, a modification flag is detected, step 46 is entered for determining 

20 whether the file was modified in a manner that would permit a virus to invade the file. Step 
46 is carried out by determining whether any of the file portions stored in step 44, when 
compared to the open file for which a closure has been requested, has changed, indicating a 
file modification. If not modified, the programming proceeds with steps 42 and 48. If 
however, it is determined that the file was modified in a manner to permit a virus to invade 

25 the file, such as the head end being changed, or a macro being changed or added in the word 
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5 portion, the anti-virus program proceeds to step 30, and therefrom to step 32 and operates as 
previously described for the first embodiment of the invention of Figure 3. 

Note that there are anti-virus programs known in the art that utilize a cache memory 
for storing data or file information upon the opening of a particular file, which information is 
indicative of the unmodified section or computer coding of a file that must be modified in 
10 order for a virus of a particular type to have an opportunity to invade that file. A cache 

memory is used for storing such file coding for every virus the anti-virus program is capable 
of scanning for to prevent entry into the protected computer. Cozza U.S. Patent No. 
5,649,095 teaches the use of such a scan information cache for detecting a plurality of 
computer viruses, whereby a "fork" portion of a file is stored when the file is opened. If a 
1 5 request for closure of the particular file is made, the stored file data is compared to the same 
: file data of the open file now requested for closure to determine if that data has been modified 

since opening the file. If modified, the anti-virus program scans the file for the type of virus 
that would invade that type of data or fork code portion of the file. However, the present 
inventor does not know of any anti-virus programs that combine a file data storage step, such 
20 as step 44, in combination with step 40 to determine whether an operating system has raised a 
modification flag, for providing criteria, such as in steps 40 and 46, for causing the anti-virus 
program to proceed to scan a file for viruses, as in step 30. Nor does the present inventor 
know of any anti-virus programs that monitor an operating system for the raising of a flag 
that indicates a file has been modified since opening, for example by accessing a preexisting 
25 "dirty cache buffer" in a server's operating system to check for the flag, for triggering the 
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scanning of the file for viruses, or for avoiding scanning of a file for viruses if no flag has 
been raised, as in the first embodiment of the invention. Contrary to the teaching of 
5,649,095 for storing a "fork" portion of a file, as indicated above, the second embodiment of 
the invention creates a "dirty cache buffer" in step 44 for storing the entire file for monitoring. 

Although various embodiments of the invention have been shown and described, they 
are not meant to be limiting. Those of ordinary skill in the art may recognize certain 
modifications to these embodiments, which modifications are meant to be covered by the 
spirit and scope of the appended claims. For example, in another embodiment of the 
invention, network protocols are monitored to determine if a write packet was received by an 
associated computer or file server for a given open file to detect that a write event has 
occurred. 
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What Ts Claimed Is : 



1 LA method for optimizing the operation of an anti-virus computer program for 

2 use with an operating system, comprising the steps of: 

3 detecting a request for closure of an opened computer file; 

4 determining in response to a closure request if the opened computer file has 

5 been modified since being opened; 

6 scanning said opened file for viruses before closure only if said opened file has 

7 been modified; and 

8 closing said file if unmodified, and closing said file after scanning for viruses 

9 if found virus free. 

1 2. The method of Claim 1, further including before said detecting step, the steps 

2 of: 

3 determining whether said operating system includes a "dirty cache buffer" to 

4 raise or set a modification flag relative to a file being modified during the time it has been 

5 open, a computer code being indicative of said flag; and 

6 using the computer code for a raised or set modification flag, if available, for 

7 carrying out said modification determining step by checking for the presence of a raised 

8 modification for said file. 
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1 3. The method of Claim 2, wherein if it is determined that said operating system 

2 does not provide a file modification flag, said method further includes the steps of: 

3 establishing a " dirty cache buffer" ; 

4 and 

5 raising a modification flag in said "dirty cache buffer" if an opened file associated 

6 with said flag has been modified by a write operation. 

1 4. The method of Claim 1 , wherein said operating system includes a "dirty cache 

2 buffer" for providing a computer code for a modification flag indicative of the modification 

3 of an open file, said method further including in said modification determining step, the step 

4 of: 

5 detecting the presence of said modification flag to determine if the associated 

6 opened file has been modified. 

1 5. The method of claim 4, further including the steps of: 

2 scanning a file for viruses in response to a request for opening the file; 

3 opening said file if virus free; 

4 establishing a cache buffer memory for storing upon opening of a file only a virus 

5 vulnerable portion of that file that a virus must use to enter and infect said file; 

6 said modification determining step including the steps of: 

7 indicating an open file is unmodified in the absence of an associated 

8 modification flag; 
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9 responding to the presence of a modification flag by comparing a portion of 

1 0 said open file to the associated unmodified virus vulnerable portion of said file in said cache 

1 1 buffer memory to determine if the portion of the open file has been modified since the 

12 opening of the file; 

13 indicating the opened file is unmodified is the virus vulnerable portion is 

14 unmodified; and 

15 indicating the opened file is modified if the virus vulnerable portion is 

16 modified. 

1 6. The method of Claim 1 , wherein said step of determining in response to a closing 

2 request if the opened computer file has been modified since being opened includes the step 

3 of: 

4 monitoring network protocols to determining if a write packet was initiated for a 
- 5 given open file. 

1 7. A method for optimizing operation of an anti-virus program in an operating 

2 system, said operating system including programming for raising a flag indicative of 

3 modification of an open file during the time the file has been open, said method including the 

4 steps of: 

5 detecting the event of a request for closing said file being made to said 

6 operating system; 

7 determining whether said modification flag has been raised by said operating 
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8 system for said open file; 

9 scanning said open file, in response to said modification flag, for viruses 

10 before permitting said operating system to close said file; and 

1 1 skipping said step of scanning for viruses before closure of said open file, 

12 whenever said modification flag is not present. 

1 8. A method for optimizing the operation of an anti-virus program in use in an 

2 operating system, said operating system including programming for raising a flag indicative 
- 3 of modification of an open file during the time the file has been open, said method including 

4 the steps of: 

5 scanning a file for viruses in response to a request from an associated 
■ 6 computer user to open and gain access to said file; 

7 permitting said file to be opened if virus free; 

8 storing upon opening a virus vulnerable unmodified portion of said open file; 

9 detecting the event of a request for closing said open file being made to said 

10 operating system; 

1 1 determining whether said modification flag has been raised by said operating 

12 system for said open file; 

13 scanning said open file, in response to said modification flag, for viruses 

14 before permitting said operating system to close said file; and 

15 skipping said step of scanning for viruses before closure of said open file, 

16 whenever said modification flag is not present; 
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17 responding to the presence of a modification flag by comparing the stored 

1 8 unmodified virus vulnerable portion of said file to the associated portion of said open file to 

1 9 determine if that portion has been modified during the time the file has been open; and 

20 skipping said step of scanning for viruses before closure of said open file if the 

21 virus vulnerable portion of said open file is unmodified. 

1 9. A computer program product for detecting computer viruses on a file server, 

-2 the file server providing file storage and retrieval services for at least one client computer 

3 over a network, said computer program product comprising: 
-4 computer code for detecting an open request from a client computer, the open request 

5 asking for a requested file from the file server; 
„<3 computer code for scanning said requested file for computer viruses, whereby the file 

7 server is permitted to provide said requested file to the client computer if no computer viruses 
8 are found therein; 

9 computer code for detecting a close request from the client computer associated with 

10 said requested file; 

1 1 computer code for accessing an operating system flag that indicates whether the 

12 requested file was changed prior to said close request; 

13 computer code for scanning said requested file for computer viruses if said requested 

14 file was changed prior to said close request; and 

15 computer code for skipping scanning said requested file if it was not changed prior to 

16 said close request. 
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1 10. The computer program product of claim 9, wherein said operating system flag 

2 i s generated externally to said computer program product by the operating system in order to 

3 reduce redundant disk writes, whereby said computer code for scanning is invoked upon 

4 closing of the requested file only when actual disk writes are made by the operating system 

5 for the requested file. 

1 11. The computer program product of claim 1 0, wherein said computer code for 

2 accessing uses a file handle generated by the operating system to identify the operating 

" 3 system flag corresponding to the requested file, said handle having been generated when the 

4 file was opened. 

L 12. A computer program product for detecting computer viruses on a file server, 

2 the file server providing file storage and retrieval services for at least one client computer 

3 over a network, said computer program product comprising: 

4 computer code for detecting an open request from a client computer, the open request 

5 asking for a requested file from the file server; 

6 computer code for scanning said requested file for computer viruses, whereby the file 

7 server is permitted to provide said requested file to the client computer if no computer viruses 

8 are found therein; 

9 computer code for detecting a close request from the client computer associated with 
10 said requested file; 
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1 1 computer code for accessing an operating system flag that indicates whether the 

12 requested file was changed prior to said close request; 

13 computer code for skipping scanning said requested file if it was not changed prior to 

14 said close request; 

15 computer code responsive to said requested file having been changed prior to said 

16 close request for determining whether a virus vulnerable portion of said file was changed; 

17 computer code for skipping scanning said requested file if a virus vulnerable portion 

18 of said file was not changed prior to said close request; and 

19 computer code for scanning said requested file if a virus vulnerable portion of said file 

20 was changed prior to said close request. 

1 13. The computer program product of claim 12, wherein said operating system 

2 flag is generated externally to said computer program product by the operating system in 

3 order to reduce redundant disk writes, whereby said computer code for scanning is invoked 

4 upon closing of the requested file only when actual disk writes are made by the operating 

5 system for the requested file. 

1 14. The computer program product of claim 13, wherein said computer code for 

2 accessing uses a file handle generated by the operating system to identify the operating 

3 system flag corresponding to the requested file, said handle having been generated when the 

4 file was opened. 
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ABSTRACT OF THE INVENTION 



Scanning time for a computer anti-virus program is minimized by eliminating 
scanning of a file for viruses before closure, in response to the absence of a modification flag 
being raised in an associated operating system, the flag being indicative of the file having 
been modified between the time the file was opened to the time of a close request. 
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(Application Serial No.) 


(Filing Date) 


(Application Serial No.) 


(Filing Date) 



I hereby claim the benefit under 35 U. S. C. Section 120 of any United States application(s), or 
Section 365(c) of any PCT International application designating the United States, listed below and, 
insofar as the subject matter of each of the claims of this application is not disclosed in the prior 
United States or PCT International application in the manner provided by the first paragraph of 35 
U.S.C. Section 112, I acknowledge the duty to disclose to the United States Patent and Trademark 
Office all information known to me to be material to patentability as defined in Title 37, C. F. R., 
Section 1 .56 which became available between the filing date of the prior application and the national 
or PCT International filing date of this application: 



(Application Serial No.) 


(Filing Date) 


(Status) 






(patented, pending, abandoned) 


(Application Serial No.) 


(Filing Date) 


(Status) 






(patented, pending, abandoned) 



(Application Serial No.) (Filing Date) (Status) 

(patented, pending, abandoned) 



I hereby declare that all statements made herein of my own knowledge are true and that all 
statements made on information and belief are believed to be true; and further that these statements 
were made with the knowledge that willful false statements and the like so made are punishable by 
fine or imprisonment, or both, under Section 1 001 of Title 1 8 of the United States Code and that such 
willful false statements may jeopardize the validity of the application or any patent issued thereon. 
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POWER OF ATTORNEY: As a named inventor, I hereby appoint the following attorney(s) and/or 
agent(s) to prosecute this application and transact all business in the Patent and Trademark Office 
connected therewith, (list name and registration number) 



Kenneth Watov, Esquire 
Registration No. 26,042 



Send Correspondenceto: 



Kenneth Watoov, Esquire 
Watov &Kipnes,P.C. 
P.O. Box 247 

Princeton Junction, NJ 08550 



Direct Telephone Calls to: (name and telephone number) 
Kenneth Watov, Esquire (609) 243-0330 



Full name of sole or first inventor 






JdTrejJVLDrew /) 






/"Sole or first^^^i^^nabjre^ / / 


, i Date 




Residence <S 1 






140 Deepdale Drive, Middletown,NJ 07748 






Citizenship 






United States of America 






Post Office Address 






140 Deepdale Drive, Middletown,NJ 07748 









Full name of second inventor, if any 



Second inventor's signature 



Post Office Address 
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